

Application No. 


Applicant(s) 


Notice of Allowability 


09/942,552 


GODWIN ETAL 


Examiner 


Art Unit 






David Y. Jung 


2134 





The MAILING DATE of this communication appears on the cover sheet with the correspondence address- 

A!l daims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate comnnunlcation will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1308. 

1 . S This communication is responsive to 6/7/2005 . 
2. 13 The allowed claim(s) is/are 1-15 . 

3. M The drawings filed on 30 August 2001 are accepted by the Examiner. 

4. □ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 1 9(a)-(d) or (f). 

a) □ All b) □ Some* c) □ None of the: 

1. □ Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received in Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (POT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
THIS THREE-MONTH PERIOD IS NOT EXTENDABLE. 

5. □ A SUBSTITUTE OATH-OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF 

INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient. 

6. □ CORRECTED DRAWINGS ( as "replacement sheets") must be submitted. 

(a) □ including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 

1 ) □ hereto or 2) □ to Paper No./Mail Date . 

(b) □ including changes required by the attached Examiner's Amendment / Comment or in the Office action of 

Paper No./Mail Date . 

Identifying Indicia such as the application number (see 37 CFR 1.84(c)) should be written on the drawings In the front (not the back) of 
each sheet. Replacement sheet(s) should be labeled as such In the header according to 37 CFR 1.121(d). 

7. □ DEPOSIT OF and/or INFORMATION about the deposit of BIOLOGICAL MATERIAL must be submitted. Note the 

attached Examiner's comment regarding REQUIREMENT FOR THE DEPOSIT OF BIOLOGICAL MATERIAL. 



Attachment(s) 

1. M Notice of References Cited {PTO-892) 5. □ Notice of Informal Patent Application (PTO-152) 

2. □ Notice of Draftperson's Patent Drawing Review (PTO-948) 6. □ Interview Summary (PTO-413), 

Paper No./Mail Date . 

3. □ Information Disclosure Statements (PTO-1449 or PTO/SB/08), 7. □ Examiner's Amendment/Comment 

Paper No./Mail Date 

4. □ Examiner's Comment Regarding Requirement for Deposit 8. ^ Examiner's Statement of Reasons for Allowance 

of Biological Material 9. □ Other . 
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DETAILED ACTION 



Allowable Subject Matter 

Claims 1-15 are allowed. The following is an examiner's statement of reasons 
for allowance: As noted in the file history (especially at page 5 of the Response filed by 
Applicant), the claimed inventions specify the jumping window" which is employed to 
reduce over-reporting of violations. With a simple sliding window approach (e.g. the 
window is moved forward by one event for each analysis step), multiple reports of 
violations are generated from a single set of failed login attempts in a short period of 
time (e.g., period shorter than the analysis window length). In such a situation, several 
window positions include a number of violation counts exceeding a threshold, which 
results in multiple alert messages, all of which are redundant except for one. The 
claimed inventions solve this problem by "jumping" the analysis window when the 
violation threshold is met for a particular window position. In this scenario, instead of 
simply moving the window ahead a single sample for the next round of analysis, the 
claimed inventions advance the window to a point where it starts at the next event 
following the last event in the previous window. As such, the window is "jumped" 
forward lo a position so Gat it does not overlap with the previous window position. This 
is noted at page 6 of the Response to be particularly recited in each of the claims using 
the language pointed out at page 6 - such as the particular features involving the 
jumping of the float period. The prior art did not teach or suggest the particular features 
of the claims. 
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Conclusion 

Points of Contact 

Any comments considered necessary by applicant must be submitted no later 
than the payment of the issue fee and, to avoid processing delays, should preferably 
accompany the issue fee. Such submissions should be clearly labeled "Comments on 
Statement of Reasons for Allowance." 

Any response to this action should be mailed to: 

Commissioner of Patents and Trademarks 
Washington, D.C. 20231 

or faxed to: 

(571) 273-8300, (for formal communications intended for entry) 
Or: 

(703) 746-5606 (for informal or draft communications, please label "PROPOSED" or 
"DRAFT") 
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Art Unit: 21 34 

Any inquiry concerning tliis communication or earlier communications from the 
examiner should be directed to David Jung whose telephone number is (571) 272-3836 
or Greg Morse whose telephone number is (571 ) 272-3838. 



David Jung 



Patent Examiner 




8/20/05 



